The systemd-mountfsd service implements the Varlink call
`io.systemd.MountFileSystem.MakeDirectory`,
which can be used to create a directory owned by the foreign uid range.
This operation seems both problematic and unnecessary:
1. It's problematic because the service only checks for directory ownership. If
the process has an
AppArmor/Landlock restriction that prevents a process from writing to a
directory, this IPC call
can bypass that. Granted the damage is low, but could assist in some kinds of
bypasses.
2. It's possible to implement this same operation (creating a directory owned
by a foreign uid
underneath a directory owned by you) just using systemd-nsresourced: if you
provide the arguments
{"target": 0, "type": "self", "mapForeign": true}, then the process is able to
simply create a
directory owned by any foreign uid by virtue of the capabilities they have as
root.
Perhaps I'm missing something, but it does seem like this operation isn't doing
anything useful.
Skye
